High [CVE-2026-73500] Denial of Service via unbounded TLS handshake goroutines
This high-severity Red Hat Linux advisory covers CVE-2026-73500 affecting Red Hat Hardened Images, cert-manager Operator for Red Hat OpenShift, ExternalDNS Operator.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello.
In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls. Conn.
Handshake() and remains tracked in the pending map.
Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
A remote attacker can exploit this by opening numerous TCP connections to an etcd TLS listener without completing the TLS handshake. This action causes the `tlsListener.acceptLoop` to spawn an unbounded number of goroutines, which consume excessive memory.
This resource exhaustion leads to a Denial of Service (DoS) for the etcd cluster and, consequently, for the Kubernetes control plane it supports. This is an Important denial of service flaw in etcd, a critical component for distributed systems and Kubernetes control planes.
A remote attacker can exhaust etcd memory by initiating numerous incomplete TLS handshakes, leading to a loss of availability for affected clusters.
- < 3.5.33
- < 3.6.14
- < 3.7.1
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
- 3.5.33
- 3.6.14
- 3.7.1
- etcd-main-3.7.1-0.1.hum1
- RHSA-2026:44868
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation checklist
- Restrict network access to the etcd TLS listener to only trusted clients and networks. Configure firewall rules to limit inbound connections to the etcd client port (default 2379) and peer port (default 2380) to authorized hosts. This reduces the attack surface by preventing untrusted network attackers from reaching the vulnerable service.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.